CVE-2010-1128

The Linear Congruential Generator LCG in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function...

CVE-2010-1128

The Linear Congruential Generator LCG in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function...

Asynchronous Auth Prompt attaches to wrong window — Mozilla

Mozilla developer Justin Dolske reported that the new asynchronous Authorization Prompt HTTP username and password was not always attached to the correct window. Although we have not demonstrated this, it may be possible for a malicious page to convince a user to open a new tab or popup to a...

Session Fixation Attack on HTTP Cookies

By manipulating cookies through a vulnerability similar to cross-site scripting, an attacker can set the session cookies. The legitimate user will be logged out of the application and after he logs in again, the cookie will remain unchanged and the attacker will be able to steal the open session...

CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

Code injection

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

UBUNTU-CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

CVE-2010-0044

PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a 1 RSS or 2 Atom feed...

Tech-ex v6. 5 CMS Oday-vulnerability warning-the black bar safety net

Background: writing website kesion directory such as http://localhost cookies: after login to grab the USER's COOKIES Account password: after registration you can log in as normal user name and password Code: the login code, grab the figure after the fill The operation,first enter the site,first...

Safari < 4.0.5 Multiple Vulnerabilities

The version of Safari installed on the remote Windows host is earlier than 4.0.5. It thus is potentially affected by several issues : - A buffer underflow in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. CVE-2009-2285 - An integer overflow in the handling of...

ESCMS cookies欺骗漏洞

% if Request.cookiesCookiesKey"ESadmin"="" then ''注意这里哦,他是通过COOKIE验证ESadmin是否为空,我们可以伪造一个值,叫他不为空 ''CookiesKey在inc/ESCMSConfig.asp文件中,默认为ESCMS$SP2 Call ErrShow Response.End End if ...... % 首先我们打开http://sitedir.com.cn/admin/esindex.html 然后在COOKIE结尾加上 ; ESCMS$SP2=ESadmin=st0p; 修改,然后刷新 进后台了嘎...

HTTP Session Cookies

The remote web application uses cookies to track authenticated users. By removing the cookies, one-by-one, and checking a protected page, it is possible to identify these cookies. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid44987; scriptversion "$Revision: 1.7 $";...

Scripts Feed Dating Software SQL Injection

============================================================================== Scripts Feed Dating Software Cookie Manip/SQLi Multiple Remote Vulnerabilities ============================================================================== + My home http://hack-tech.com + Date Submitted: February 27...

ESCMS vulnerability website system 0day-vulnerability warning-the black bar safety net

Version:ESCMS V1. 0 SP1 Build 1 1 2 5 Background login authentication is through the admin/check. asp achieved,look at the code % if Request. cookiesCookiesKey"ESadmin"="" then 'Note that here Oh,he is by COOKIE validation ESadmin is empty,we can forge a value,called he is not empty 'CookiesKey i...

Debian DSA-1871-1 : wordpress - several vulnerabilities

Several vulnerabilities have been discovered in wordpress, weblog manager. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-6762 It was discovered that wordpress is prone to an open redirect vulnerability which allows remote attackers to conduct...

Limny v2.0 Change Email and Password CSRF Exploit

Exploit for unknown platform in category web applications ================================================= Limny v2.0 Change Email and Password CSRF Exploit ================================================= /????????????????????????????\ :Limny 2.0 Change Pass CSRF : / /Discovered By: \ |Luis...

Limny 2.0 - Cross-Site Request Forgery (Change Email and Password)

/¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\ :Limny 2.0 Change Pass CSRF : / /Discovered By: \ |Luis Santana | / Overview ¯¯¯¯¯¯¯¯¯¯ The Limny 2.0 CMS is vulnerable to a Cross-Site-Request Forgery exploit which allows for a malicious attacker to change the password, and email address, of any user, including...

Limny v2.0 Create Admin User CSRF Exploit

Exploit for unknown platform in category web applications ========================================= Limny v2.0 Create Admin User CSRF Exploit ========================================= /????????????????????????????\ :Limny 2.0 CSRF : / /Discovered By: \ |Luis Santana | / Overview ?????????? The...

ULoki Community Forum 2.1 Cross Site Scripting

Exploit Title: ULoki Community Forum v2.1 usercp.php Cross Site Scripting Date: 10/02/2010 Author: Sioma Labs Software Link: http://www.uloki.com/download/ulokiforum06may2009.zip Version: v2.1 Tested on: Windows SP 2 / WAMP CVE : Code : / | | | | | \ | |/ | ' \ / | | | / | ' / | | | | | | | | |...